Amendments to the Claims 



1 . (Currently amended) A computer- implemented method for adaptively filtering 
messages routed across a network --rh^-r^v-^^^ 

; _ ■ , , ,0 , , On - '.-Jo:- . Os ^ v o 0s 

. M, the method comprising: 

rejecting the fir s i : 5 ; aj - 0 i- ? - o> I 01* a 1 jocuon rule. 

delermimng, for :iv fi r-. = r-. >s«ge,.aa.i - ; * : • ; ' :: ; ; ggcj /d Ql^JM^M!?. 

extracting, from the rejected messages; artribuv » 

incrementin g, for the attribute, a count of t he 
i o n Jh^attnbjite; 

based on the count for eaefe-the attribute, determining a frequency with 
which She-messages having the attribute were rejected fey-based on ihe rejection 
rule; and 

generating an exception rule to the rejection rule which rejected the 
messages with the attribute, responsive to the determined frequency ef-the 
attribute exceeding a threshold^ 

receiving a second message having the attribute; and 
allowing the second message, responsive to the exception rule. 

2. (Cancelled). 

3. (Cancelled). 

4. (Original) The method of claim 1, wherein the attribute is one of a message 
component, a value, a data type, and a length. 
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5. (Original) The method of claim 1, wherein the frequency is a weighted count of 
occurrences of the attribute. 

6. (Original) The method of claim 1, wherein the frequency is a direct count of 
occurrences of the attribute. 

7. (Original) The method of claim 1, wherein the rejected messages are URL requests, 
each URL request having at least one URL component, the method further comprises: 
maintaining a frequency for each instance of a URL component, wherein the frequency is 
a function of a number of occurrences with which a URL component and its descendants 
were rejected by a rule; selecting a URL component according to a set of constraints; and 
generating an exception rule for the selected URL component and its descendants. 

8. (Original) The method of claim 7, wherein the exception rule is generated by 
inferencing a scalar data type of the descendants of the selected URL component. 

9. (Original) The method of claim 7, wherein the set of constraints is selecting a URL 
component with a frequency exceeding a threshold and having no children with a 
frequency above the threshold. 

10. (Original) The method of claim 7, wherein the set of constraints is selecting a URL 
component with the frequency exceeding a threshold. 

1 1 . (Original) The method of claim 7, wherein the function is an aggregate of a number 
of occurrences with which the URL component was rejected by a rule and the number of 
occurrences with which descendants of the URL component were rejected by the rule. 

12; (Original) The method of claim 1, wherein the messages are URL requests, each 
URL request having at least one URL component, and the method further comprises: 
storing rejected URLs in a trie structure, wherein each node in the trie structure is 
associated with a URL component; maintaining a frequency for each node associated 
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with a URL component, wherein the frequency is a function of a number of occurrences 
with which a URL component associated with a node and its descendants were rejected 
with a rule; selecting a node in the trie structure according to a set of constraints; and 
generating an exception rule for the selected node and its descendants. 

13. (Original) The method of claim 12, wherein the exception rule is generated by 
inferencing a scalar data type of the descendants of the selected node. 

14. (Original) The method of claim 12, wherein the set of constraints is selecting a node 
with the frequency exceeding a threshold. 

15. (Original) The method of claim 12, wherein the set of constraints is selecting a node 
with a frequency exceeding a threshold and having no children with a frequency above 
the threshold. 

16. (Original) The method of claim 1, wherein the threshold is a product of a total 
number of messages over a time interval and a percentage of the messages that should be 
allowed to pass. 

17. (Currently amended) A system for adaptively filtering messages routed across a 
network by generating exception rules to rejection rules base d on attributes of messages 
previously received and rej ectedy^-messages-re^ the system 
comprising: 

a receiver which receives a first message; 

< ! ! <-^ '■ >V< thv- \'\ ! >M:VS b <l j OJ , HUM Wk\ 

a learning engine, for extracting, from the first m essages, an attributes of the 
messages that triggered a the rejection rule, for incrementing, for the attribute, a count of 
the number of mess ages rejected based on the attri bute, for determining, based on the 
count for eaeh -the attribute, a frequency with which the-messages having the attribute 
were rejected by -based on the rejection rule, and for generating an exception rule to the 
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rejection rule which rejected the messages with the attribute, responsive to the 
determined frequency exceeding a threshold; and wheren 

the a fjlterv-fef-app-lyin g applies the exception rule to f&feeted- subsequent messages 
to determine whether to allow the rejected subsequent messages. 

18. (Original) The system of claim 17, wherein the filter is further adapted to: identify 
an attribute of the rejected message that triggered a rejection rule; for the triggered 
rejection rule, identify an exception rule that matches the attribute; and . apply the 
exception rule to a rejected message to determine whether to allow the message. 

19. (Original) The system of claim 17, wherein the attribute is one of a value, data type, 
and length. 

20. (Original) The system of claim 17, wherein the frequency is a weighted count of 
occurrences of the attribute. 

21. (Original) The system of claim 17, wherein the frequency is a direct count of 
occurrences of the attribute. 

22. (Original) The system of claim 17, wherein the rejected messages are URL requests, 
each URL request having at least one URL component, and the learning engine further 
adapted to: maintain a frequency for each instance of a URL component, wherein the 
frequency is a function of a number of occurrences with which a URL component and its 
descendants were rejected with a rule; select a URL component according to a set of 
constraints; and generate an exception rule for the selected URL component and its 
descendants. 

23. (Original) The system of claim 17, wherein the set of constraints is selecting a URL 
component with the frequency exceeding a threshold and having no children with a 
frequency above the threshold. 
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24. (Original) The system of claim 17, wherein the set of constraints is selecting a URL 
component with the frequency exceeding a threshold. 

25. (Original) The system of claim 22, wherein the function is an aggregate of a number 
of occurrences with which the URL component was rejected by a rule and a number of 
occurrences with which descendants of the URL component were rejected by the rule 

26. (Original) The system of claim 22, wherein the exception rule is generated by 
inferencing a scalar data type of the descendants of the selected URL component. 

27. (Original) The system of claim 17, wherein the messages are URL requests, each 
URL request having at least one URL component, and the learning engine is further 
adapted to: store rejected URLs in a trie structure, wherein each node in the trie structure 
is associated with a URL component; maintain a frequency for each node associated with 
a URL component, wherein the frequency is a function of a number of occurrences with . 
which a URL component and its descendants were rejected with a rule; select a node 
according to a set of constraints; and generate an exception rule for the selected node and 
its descendants. 

28. (Original) The system of claim 17, wherein the set of constraints is selecting a node 
with the frequency exceeding a threshold. 

29. (Original) The system of claim 17, wherein the set of constraints is selecting a node 
with a frequency exceeding a threshold and having no children with a frequency above 
the threshold. 

30. (Original) The system of claim 27, wherein the exception rule is generated by 
inferencing a scalar data type of the descendants of the selected node. 
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3 1 . (Original) The system of claim 17, wherein the threshold is a product of a total 
number of messages over a time interval and a percentage of the messages that should be 
allowed to pass. 

32. (Currently amended) A computer program product comprising: a computer-readable 
medium having computer program code embodied therein for adaptively filtering 
messages routed across a network b\ gene < N i , , j i> i j 
on attributes of messages previously received and rejectedr^fee-flftessftges^eeted-based 
on a set of reject i on rules, the computer program code adapted to: 

receive a first message: 

reject the first message based on a rejection rule; 

determine, for the first message, an attribute that triggered the rejection 

rule; 

extract, from the rejected messa ge, an attribute that triggered the rejection 

rule: 

Increment foj the dUi , iui , a , „ uv.ui\< \ ^\ > _os i .jeoied 
based on the attribute; 

bMMmthe count for the attribute, determinin g a fre quency with which 
messages having the attribute were rejected based on the rejection rule; and 

generate an exception rule to the rejection rule which rejected the message 
with the attribute, responsive to the determined frequency of the attribute 
e y di ng a threshold; 

recj : i \ i n g. a secon c] LAftgsgagg. MylugJllg.M r ib_ylglMd 

allowing the second message based on the exception rule. -e xtra&t - . : -- fr - em -t h e 
rejected messages, attributes of the messages that triggered a rej"ectio-n-mle--fe-r 
c-.±ch at- i*i€d fr e qu e ncy with which the m e ssag e s having th e 

attribute we re rejected by the rejection rule; and gener ate an exception rule to the 
r e j e ction rul e whie h-f-ejee-t^d- the messages withth e afcte feu t e , responsiv e to th e 
frequeney-e- xeeedi - n - g - a-th - r - es - he l d: 

33. (Cancelled) 
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34. (Cancelled). 



35. (Original) The computer program product of claim 32, wherein the attribute is one of 
a value, data type, and length. 

36. (Original) The computer program product of claim 32, wherein the frequency is a 
weighted count of the occurrences of the attribute. 

37. (Original) The computer program product of claim 32, wherein the frequency is a 
direct count of the occurrences of the attribute. 

38. (Original) The computer program product of claim 32, wherein the rejected messages 
are URL requests, each URL request having at least one URL component, wherein the 
computer program code is further adapted to: maintain a frequency for each instance of a 
URL component, wherein the frequency is a function of a number of occurrences with 
which a URL component and its descendants were rejected by a rule; select a URL 
component with the frequency exceeding a threshold and having no children with a 
frequency above the threshold; and generate an exception rule for the selected URL 
component and its descendants. 

39. (Original) The computer program product of claim 32, wherein the computer 
program code is further adapted to generate the exception rule by inferencing a scalar 
data type of the descendants of the selected URL component. 

40. (Original) The computer program product of claim 38, wherein the function is an 
aggregate of a number of occurrences with which the URL component was rejected by a 
rule and the number of occurrences with which descendants of the URL component were 
rejected by the rule. 
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41 . (Original) The computer program product of claim 32, wherein the rejected messages 
are URL requests, each URL request having at least one URL component, wherein the 
computer program code is further adapted to: store rejected URLs in a trie structure, 
wherein each node in the trie structure is associated with a URL component; maintain a 
frequency for each node associated with a URL component, wherein the frequency is a 
function of a number of occurrences with which a URL component and its descendants 
were rejected with a rule; select a node with the frequency exceeding a threshold; and 
generate an exception rule for the selected node and its descendants. 

42. (Original) The computer program product of claim 32, wherein the computer 
program code is further adapted to generate the exception rule by inferencing a scalar 
data type of the descendants of the selected node. 

43. (Original) The computer program product of claim 32, wherein the function is an 
aggregate of a number of occurrences with which the URL component was rejected by a 
rule and a number of occurrences with which descendants of the URL component were 
rejected with the rule. 

44. (Original) The computer program product of claim 32, wherein the computer 
program code is further adapted to determine the threshold as a product of a total number 
of messages over a time interval and a percentage of the messages that should be allowed 
to pass. 
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